[marius-kilocode]

Upstream sync of the v2 line (#15020) to OpenCode v2.1.0. Previous sync: #15136 (v2.0.30).

Merge with 'Create a merge commit'. Do not squash or rebase. A squash drops the upstream ancestry, and the next sync conflicts again. The annotation check and the shared-patch counter also find the pinned upstream release from the merge commit message.

Release

Item	Value
Target	upstream v2.1.0, tag commit 60c68d145a1 (2026-10-20)
Merged commit	release commit 9d90d892dcb (parent of the tag, on upstream/dev, newest v2.x.y tag at merge time)
Included releases	v2.0.31 (d889cb20447, 2026-10-16), v2.0.32 (d4a6223d017, 2026-10-16), v2.1.0 (9d90d892dcb, 2026-10-20)
Previous pin	v2.0.30 release commit 775d1d0d713
Merge commit	b70010d8dfe chore(upstream): sync v2.1.0 (9d90d892dcb)
Lag before	3 releases (v2.0.31, v2.0.32, v2.1.0), 4.5 days
Lag after	0 releases, 0 days
History added	156 upstream commits

Why three releases in one PR

migration-context.md allows several pending releases in one sync when the PR says why. Per release, measured against the files that Kilo adds or changes since v2.0.30 (files in the removed product areas of #15151 are left out, because skipFiles resolves them):

Release	Commits	Files changed upstream	Overlap with Kilo-changed files
v2.0.31	40	252	setup-bun/action.yml, test.yml, AGENTS.md, bun.lock, 4 package.json, cli/src/server-process.ts, tui/src/component/dialog-integration.tsx, turbo.json, 4 core test files
v2.0.32	15	86	test.yml, bun.lock, 4 package.json, turbo.json
v2.1.0	101	719 (mostly docs and the removed Console)	README.md, bun.lock, 4 package.json, cli/src/server-process.ts, core/src/plugin/sdk.ts, tui/src/plugin/builtins.ts, core/test/config/config.test.ts

Together, 2 files need a manual resolution (test.yml, turbo.json), and both are CI files that upstream restructured in v2.0.31 and v2.0.32. Stacked PRs would resolve the same two files twice and repeat the checks, self-tests and CI three times. The merge used --allow-skip.

v2.1.0 is a minor release. Its breaking changes (anomalyco/opencode#57260: session events, compaction, credential-legacy, plugin session API) were checked against every Kilo-owned path and every kilocode_change hunk. No Kilo code uses a renamed or removed symbol.

How it was made

bun script/upstream/merge.ts --version v2.1.0 --base-branch HEAD --allow-skip on a fresh branch from origin/v2 (052f6a6bedf), with Bun 1.4.2 on PATH. The tool removed 9 workflows and 280 skipped files, resolved sdk.ts and setup-bun/action.yml with mergiraf, transformed 2 package.json files, kept the lock file, and stopped on test.yml and turbo.json.

Conflicts and resolutions

File	Kind	Resolution
9 workflows (deploy*.yml, models-snapshot.yml, nix-hashes.yml, publish.yml)	modify/delete	Kept deleted. Done by the tool. No new upstream workflow
sst.config.ts and 280 files in removed product areas	modify/delete, add	Kept removed (skipFiles). Done by the tool
packages/core/src/plugin/sdk.ts	content	Mergiraf. Upstream publishes sdk.plugin.updated globally (anomalyco/opencode#57181) on the line that the Kilo phase seam wraps. Result: Kilo phases map kept, { global: true } taken. Rung 3, unchanged
.github/actions/setup-bun/action.yml	content	Mergiraf left two if: keys on Restore Bun dependencies. Upstream now skips the Bun cache on Windows itself (anomalyco/opencode#55866), so the Kilo copy of that change is dropped and upstream's lines are taken. The Kilo Defender step stays
packages/{cli,core,tui}/package.json	content	Upstream moved typecheck to tsc (TypeScript 7, anomalyco/opencode#56300). The package.json transform took upstream and dropped Kilo's test:ci scripts and the @opencode/cli ./* export (tooling gap). Rebuilt from upstream with the Kilo lines added again; the Kilo diff of all three files is now identical to before
turbo.json	content, manual	Upstream adopted the transit task and a generic test task on transit that runs every package with a test script (anomalyco/opencode#55866, anomalyco/opencode#56117). Took upstream. Dropped Kilo's own transit and @kilocode/gateway-core#test, which upstream now covers. Kept the three Kilo test:ci tasks, now with dependsOn: ["transit"] like upstream's test (tests no longer wait for dependency builds)
.github/workflows/test.yml	content, manual	Took upstream and applied the Kilo patches again: v2 push trigger, if: false on affected, shard matrix, Turbo cache step, sharded test:ci run, JUnit report steps, sdk job. Upstream now has the separate build job and the two-commit PR checkout, so Kilo's copies are dropped. See the next section for two new adaptations
bun.lock	content	Kept ours, regenerated with Bun 1.4.2 in the follow-up commit (see below)

Plugin-first check: no conflict hit a Kilo code patch. sdk.ts (rung 3 seam) kept its shape. server-process.ts, builtins.ts and dialog-integration.tsx merged without conflict, and their Kilo hunks are identical.

Follow-up commits

1. c1a31af8f77 chore(kilo): typecheck Kilo packages with TypeScript 7. Upstream removed the @typescript/native-preview catalog entry, so bun install failed for kilo-cli, kilo-plugin and kilo-gateway-core. They now use @typescript/native and tsc --noEmit, and list "types": ["bun"] in tsconfig.json, as every upstream package does since TypeScript 7 (it no longer loads @types/* by default). Kilo-owned files only. bun.lock regenerated here.
2. 3d4426c2903 fix(ci): keep the v2.1.0 test workflow working without the app packages.
   • Upstream's new Build workspace libraries step filters on @opencode/app^.... Kilo removed that package, and turbo fails with No package found with name '@opencode/app' (reproduced locally). The filter is now @opencode/cli^... only, marked.
   • Upstream's new e2e (linux) and e2e (windows) result jobs require affected to succeed. Kilo skips affected, so they would always fail. They get if: false, marked. v2 has no required status checks, so skipped checks block nothing.
   • The Kilo sdk job moves back to the end of the file, so git aligns the diff with upstream correctly (otherwise upstream's Check generated client steps showed as unmarked Kilo lines).
3. 0d9a9fb8c84 chore(upstream): lower the shared-patch baseline after v2.1.0. Limits lowered, seam texts for setup-bun/action.yml, test.yml and turbo.json updated.
4. 35881134692 fix(kilo-plugin): check out prompt templates with LF on Windows (see CI).
5. c2eaa870ff5 merge of origin/v2 (docs(migration): record the direction rule in the placement rules and skills #15281). The only conflict was the markedLines limit: 280 here plus the one AGENTS.md line of docs(migration): record the direction rule in the placement rules and skills #15281 gives 281.

Kilo changes kept

Kilo's diff against upstream was compared before the sync (775d1d0d713..origin/v2) and after it (9d90d892dcb..HEAD), file by file on the added and removed lines. Outside the removed product areas, the file lists match. Every Kilo patch is identical, except these intended differences:

• setup-bun/action.yml, test.yml, turbo.json: smaller, because upstream adopted the Windows cache skip, the transit hashing, the separate build job and the two-commit checkout (see above).
• packages/kilo-{cli,plugin,gateway-core}/{package,tsconfig}.json: TypeScript 7.
• script/upstream/shared-patches.json: baseline.
• bun.lock: generated.

Shared files touched

Shared-patch counter against 9d90d892dcb: 31 shared files, 281 marked lines (316 on origin/v2 before #15281, 317 after it), 38 unmarked lines (was 50), 0 deleted shared files, 28 deleted upstream workflows (not counted). Annotation check: ok (60 shared files).

Placement rules (v2-host-strategy.md section 5, #15281): no change in this PR moves code from a Kilo-owned file into an upstream file, and no upstream test file is edited. The two new marked lines in test.yml adapt Kilo's CI to jobs that upstream added. The Windows fix is a Kilo-owned file. Note for U-L3-01: the turbo.json test:ci entries name script/kilocode/ paths, so under the new rung-4 test they are rung 4; the relabel comes with the checker, as the plan says.

Mirror drift and dependency impact

Mirror drift (v2-host-strategy.md section 7, done by hand until mirroredFiles lands):

Kilo mirror	Upstream file	Upstream diff 775d1d0d713..9d90d892dcb
packages/kilo-cli/src/index.ts	packages/cli/src/index.ts	none
packages/kilo-cli/src/serve.ts	packages/cli/src/commands/handlers/serve.ts	none

Dependency impact (by hand, script/upstream/impact.ts does not exist yet): upstream files that each Kilo feature imports, resolved from its imports, and the ones this sync changes.

Feature	Changed / imported	Changed files	Effect on Kilo
gateway (kilo-plugin/src/gateway, tui/src/kilocode, schema/src/kilocode)	7 / 16	core/variant.ts, core/bus.ts, schema/credential.ts, schema/model.ts, tui/ui/dialog-select.tsx, tui/ui/dialog.tsx, tui/context/theme.tsx	Variant.resolve has more provider packages, Key.configuration removed (Kilo uses OAuth), dialogs rebuilt on DialogLayout with unchanged props. Retested: identical Kilo model lists, packages and 771 variants (see Verification)
agents (kilo-plugin/src/agent)	3 / 8	core/permission.ts, core/shell.ts, schema/session-event.ts	Permission metadata drops undefined values; AgentSelected and Shell.DIRECTORY unchanged. Retested: agent behavior (see Verification)
host (kilo-cli/src, kilo-plugin/src/index.ts)	7 / 61	cli/server-process.ts, core/plugin/sdk.ts, core/bus.ts, util/npm.ts, 3 CLI import handlers	server-process.ts: service chdir failure is non-fatal, and the service applies its saved environment; the Kilo overrides hunk is unchanged. Retested: bun dev, TUI, standalone server
config (core/src/kilocode)	1 / 1	util/fs-util.ts	Sandbox EPERM is read like not-found

Upstream behavior that affects Kilo

• Default model when signed out: upstream prefers OpenCode free models, and big-pickle first, when every enabled model is a free OpenCode model (anomalyco/opencode#55852, anomalyco/opencode#55972). The Kilo Gateway keeps provider kilo enabled and sets an explicit default, so the default stays kilo/kilo-auto/free (verified, see Self-test). Only when the Gateway catalog fails or is empty does the fallback become opencode/big-pickle instead of the first OpenCode model.
• Model picker order: /models opens on the current model and keeps the server's model order (anomalyco/opencode#57151). The Kilo group now follows the Gateway catalog order instead of an alphabetical sort.
• Kilo Gateway requests: store is now sent only to OpenAI and Azure (anomalyco/opencode#57239), so Kilo chat requests no longer send store: false. Gateway answers in the self-test are fine. streamUsage is a new compatibility option, default on (anomalyco/opencode#57255).
• CI: Turbo now runs every package that has a test script, so @kilocode/kilo-plugin and @kilocode/kilo-cli tests run in CI shard 1 too.
• Also in these releases: TypeScript 7 typecheck, OpenTUI 0.6.6, session archiving (anomalyco/opencode#53759), editing saved permissions (anomalyco/opencode#56659), plugin session.list (anomalyco/opencode#56264), todowrite behind an experimental flag (anomalyco/opencode#56947), a new TUI dialog design behind the new-designs experiment.

Open PRs

git merge-tree against the only open v2 PR, #15281: one conflict on the markedLines limit in shared-patches.json (316 to 317 there, 316 to 280 here). After this PR merges, the value is 281.

Tests

Same command on origin/v2 (052f6a6bedf) and on this branch: bun run test in each package, with OPENCODE_TEST_HOME and XDG_* in a temp directory, from detached worktrees outside the repository (Bun 1.4.2, macOS).

Package	origin/v2	This branch	New failures
kilo-gateway-core	73 pass, 0 fail	73 pass, 0 fail	0
kilo-plugin	25 pass, 0 fail	25 pass, 0 fail	0
kilo-cli	10 pass, 0 fail	10 pass, 0 fail	0
plugin	9 pass, 0 fail	9 pass, 0 fail	0
server	82 pass, 0 fail	87 pass, 0 fail	0
cli	329 pass, 1 fail	332 pass, 1 fail	0 (same test)
tui	1488 pass, 0 fail	1535 pass, 0 fail	0
core	6619 pass, 6 fail	6669 pass, 6 fail	0 (same 6 tests)

The failures in both columns are local-environment failures, the same as in #15136: Session.shell timing (6, each hits the 5 s limit) and debug paths command (1). Skipped tests added by this PR: 0.

CI

Run 1 (before the Windows fix): every check green except unit (windows, 1/3). Upstream's generic Turbo test task now runs @kilocode/kilo-plugin tests in CI for the first time, and on Windows the agent-switch reminder test failed. With core.autocrlf, packages/kilo-plugin/src/agent/agent-switch.txt is checked out with CRLF, so the reminder text has \r\n. The bug is on origin/v2 too (it never ran there), and it also affects Windows users: the reminder and the Ask, Debug and Orchestrator prompts carry CRLF. Fix (35881134692): packages/kilo-plugin/.gitattributes with src/**/*.txt text eol=lf, the same rule upstream has for packages/core/src/**/*.txt in the root file. Kilo-owned file (rung 2), no shared file changed.

Run 2 (after the fix and the origin/v2 merge): the kilo-plugin tests pass on Windows. The same job then failed in @opencode/util#test with a Bun crash: panic(main thread): Segmentation fault at address 0x100000000, error: script "test" exited with code 3, Bun 1.4.2 Windows x64. All util tests passed before the crash (0 fail), and the crash is at process exit. This is a Bun defect, not a test failure, and it is not caused by this sync: packages/util has one upstream change (the sandbox EPERM read handling in fs-util.ts), no assertion failed, and the same package is green on Linux. One rerun of that job was started, and it passed (3m34s). The whole workflow is green at c2eaa870ff5.

Verification

• bun install --frozen-lockfile with Bun 1.4.2: no lock change.
• bun script/check-workflows.ts: ok (3 workflows).
• bun script/check-opencode-annotations.ts: ok (60 shared files against 9d90d892dcb).
• bun script/check-shared-patches.ts: ok (counts above).
• bun script/upstream/find-reset-candidates.ts --dry-run: no file to reset (the 28 local-missing entries are the deleted upstream workflows).
• packages/protocol and packages/client check:generated: pass.
• bun script/upstream/progress.ts --check: up to date.
• bun typecheck in kilo-gateway-core, kilo-plugin, kilo-cli: pass (also from the Agent Manager worktree, now that TypeScript 7 limits the loaded types).
• bun run check from a worktree outside the repository: pass (28 of 28 tasks).
• bun turbo build --filter='@opencode/cli^...' (the CI library build step): pass (14 of 14 tasks).
• Self-test, from the Agent Manager worktree at this branch's head, fresh KILO_V2_PROFILE per test, signed out unless noted:
  • bun dev run --standalone --format json "Reply with only the word ok." with no --model: answers ok with kilo/kilo-auto/free, no level=ERROR log lines. Pass. (script/dev-isolated.ts sets model through OPENCODE_CONFIG_CONTENT, so the Gateway default is checked separately below.)
  • Gateway, standalone server (bun dev serve) on this branch and on origin/v2, OPENCODE_CONFIG_CONTENT='{}', GET /api/model and /api/model/default:
    • Signed out: 17 Kilo models on both, default kilo/kilo-auto/free on both.
    • Signed in (KILO_API_KEY from the v1 auth file): 295 Kilo models on both, the same default on both.
    • Kilo model IDs, package and reasoning variants (771) identical. The only difference in the full list: 2 Bedrock bare IDs hidden by upstream on purpose (anomalyco/opencode#54486). Pass.
  • Agents, bun dev run --agent <id> with "Create a new file named made-by-.txt", on this branch and on origin/v2:
    • Code and Debug write the file. Ask and Plan do not (on this branch both answered that their mode cannot modify files).
    • The run without --agent uses Code.
    • Orchestrator delegates through subagent and the file is written (on this branch, the first run with kilo-auto/free returned an unrelated answer instead; a rerun delegated and wrote the file).
    • Same results on both trees. Pass.
  • TUI with the skill harness: home screen shows Code · Auto Free Kilo Gateway. Pass.
  • Prompt What is 2 + 2? Reply with only the number.: answered 4. Pass.
  • Model picker (ctrl+x m): ● Auto Free selected, the Kilo (free) models listed. The same check on origin/v2 shows the same layout; only the order inside the Kilo group differs (see above). Pass.
  • /connect, search kilo: lists Kilo Gateway. Pass.
  • No level=ERROR lines in the CLI log. Pass.
  • bun dev models --standalone on this branch and on origin/v2: identical kilo/ list (17 models) and opencode/ list (10 models). Pass.
• Limit: the chooseKiloAccount team chooser after /connect needs a real Kilo login, so it was not run. Its code merged without change, and typecheck passes.

Tooling gaps

• transforms/transform-package-json.ts takes upstream for a conflicted package.json and re-applies only the root dev and lint scripts. It dropped Kilo's test:ci scripts in cli, core and tui, and the @opencode/cli ./* export. Restored by hand. The transform should re-apply every Kilo line from the base diff.
• Mergiraf produced a duplicate if: key in setup-bun/action.yml when both sides added the same condition. Fixed by hand.
• merge.ts cannot regenerate bun.lock when upstream removes a catalog entry that a Kilo-owned package uses. The lock is regenerated in the follow-up commit.
• The v2-migration skill reads CLI logs from data/opencode/log. Since #15270 the profile uses data/kilo2/log.
• merge.ts needs --allow-skip for a multi-release sync. This works as designed.

[github-actions]

➖ v2 migration progress: 0.9% → 0.9% (0 done, 0 total, 0 dropped; 87/9829 cells)

Placement: 7 new marked lines in shared files (7 seam), 0 new kilo_port annotations, 0 new core-internal imports.

Ratchets: 9 core-internal imports (base 9); shared patches by rung 29 seam, 2 patch (base 29 seam, 2 patch).

No change to the progress map.

Full map · how cells close

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​typescript/​typescript6@​6.0.2
	npm/​@​opencode-ai/​pty@​0.2.0 ⏵ 0.3.1			+1	+2
	npm/​typescript@​5.8.2 ⏵ 7.0.2			-1		+10
	npm/​@​opentui/​core@​0.5.17 ⏵ 0.6.6			+1
	npm/​@​opentui/​keymap@​0.5.17 ⏵ 0.6.6				+1
	npm/​@​opentui/​solid@​0.5.17 ⏵ 0.6.6				+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm typescript License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: package.json → npm/@typescript/typescript6@6.0.2 → npm/typescript@6.0.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@6.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[kilo-code-bot]

Code Review Summary

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	2

Kilo-changes audit: the Kilo patches of all 314 shared/Kilo files outside skipFiles are identical before (775d1d0d713..origin/v2) and after (9d90d892dcb..c2eaa870ff) the sync; the only intended differences are the ones the body names (test.yml, turbo.json, setup-bun/action.yml, the three Kilo package.json/tsconfig.json files for TypeScript 7, shared-patches.json, bun.lock), plus the new Kilo-owned packages/kilo-plugin/.gitattributes. Deleted upstream workflows stay deleted, shared-patches.json is valid (31 files, 281/38) and no conflict markers remain.

Upstream impact: no break found in the Kilo seams touched by v2.1.0 — SdkPlugins.register keeps the phase map and takes { global: true } (packages/core/src/plugin/sdk.ts:40), sdk.all()/all("post") still split correctly in packages/core/src/plugin/supervisor.ts:154,162, server-process.ts/server/src/process.ts keep overrides, util/src/global.ts is unchanged, and Kilo-owned code uses none of the renamed fields (providerState, providerContext, recent, Credential.Key.configuration). CI status was not readable with the permitted commands; this review covers the diff only.

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
PR description	—	Stale at the current head: "Follow-up commits" lists three commits, but the branch now also has 3588113469 fix(kilo-plugin): check out prompt templates with LF on Windows and merge c2eaa870ff of origin/v2 (which contains #15281). "Open PRs" still describes #15281 as open and predicts the future markedLines value, which is now already merged at 281.
packages/tui/src/kilocode/gateway.tsx	—	The self-test does not exercise chooseKiloAccount, the Kilo account/team chooser. It is a Kilo seam inside packages/tui/src/component/dialog-integration.tsx, whose dialog stack (DialogLayout, DialogFooter actions shape, DialogSelect) was rewritten in v2.1.0, so one manual check of the post-login team picker (or a recorded gap) would close the only untested TUI branch on this sync. The PR's Tests section also still says the per-package comparison against origin/v2 is running rather than giving its result.

Files Reviewed (315 files)

• All 314 files in the Kilo patch outside skipFiles (per-file added/removed line comparison before vs after the sync)
• .github/workflows/test.yml, .github/workflows/check.yml, .github/actions/setup-bun/action.yml, turbo.json, script/upstream/shared-patches.json
• Kilo seams in shared code: packages/core/src/plugin/sdk.ts, packages/core/src/plugin/supervisor.ts, packages/cli/src/server-process.ts, packages/server/src/process.ts, packages/util/src/global.ts, packages/tui/src/component/dialog-integration.tsx, packages/tui/src/plugin/builtins.ts
• Upstream v2.1.0 changes under packages/{schema,plugin,core,server,util,cli,tui}/src relevant to those seams
• Kilo-owned follow-ups: packages/kilo-{cli,plugin,gateway-core}/package.json, tsconfig.json, packages/kilo-plugin/.gitattributes

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash-1017 · Input: 201.1K · Output: 51.6K · Cached: 14M}

_{Review guidance: REVIEW.md from base branch v2}

[marius-kilocode]

.opencode needs to get removed after: #15282 lands